Many challenges to Indo-pacific cyber agreement

There are multiple challenges that come in the way of ensuring maritime cybersecurity in the Indo-Pacific. While some of these challenges are specific to the Indo-Pacific, a number of them are applicable more universally. The Indo-Pacific is a geopolitically fraught region home to half of the world’s population with a 60 per cent share of global maritime trade. It has a long coastline and massive (but complex) maritime landscape with major powers (India, China, United States), unstable states (Iraq, Iran, Pakistan, North Korea), contested maritime boundaries and islands (South China Sea and the East China Sea), and chokepoints (Malacca Strait and Lombok Strait). Along with this, piracy threats (Horn of Africa and Southeast Asia) as well as the presence of emerging/ambitious (Japan, Australia, Vietnam, Philippines, Indonesia, Iran), established (India, China, US) and extra-regional (UK, France, Russia) navies makes the region volatile in nature. Hopcraft and Martin (2018) highlight why the Indo-Pacific stands out as compared to other regions:

While full digitalization of ships and related systems is a global risk-management issue, it is of high significance to the Indo-Pacific region, which incorporates the third largest of the world’s oceans and acts as the gateway to many of the major shipping lanes, straits and canals, including the Suez Canal (Hopcraft & Martin, 2018, para. 3).

The composition and characteristics of the Indo-Pacific highlighted above makes the issue of maritime cybersecurity difficult to address in the region. This issue is compounded by five universal challenges faced by the maritime industry. These are discussed below.

First is the complex nature of the maritime industry. A ship is built, owned and operated by different companies usually located in different countries. Further, it is registered in, crewed by, and carries cargo or passengers from, numerous countries across continents. During the voyage, it travels through multiple EEZs, territorial seas, disputed and contested regions, sovereign canals as well as international waters. It visits all kinds of ports with varying infrastructure and processes. This complexity of the maritime industry means that any cybersecurity incident involves multiple companies and states. In such a scenario, where multiple entities share jurisdiction, both preventive cybersecurity measures and post-incident response suffer due to a lack of clearly delineated responsibilities (Karim, 2022; Loomis et al., 2021).

Second, overcoming the barriers imposed by path dependency is challenging. The maritime industry today comprises all kinds of vessels, from decades-old ships using legacy systems to ships retrofitted with systems over the years to brand new ships with sophisticated systems. Many ships in operation today were designed during the latter part of the twentieth century and early twenty-first century when piracy was the most important threat. Therefore, physical security of the ships was an important element incorporated in ship-building by design (Loomis et al., 2021). Given that vessels, especially large container ships, are very costly (Paris, 2019; Brock, 2022) and have a long life (Jiang, 2017), it is very difficult for stakeholders to overhaul them (for cybersecurity related enhancements) in a short period of time. Therefore, even if cybersecurity by design is adopted widely by the maritime industry, it will take decades before it becomes effective in thwarting cybersecurity threats on any meaningful scale.

The third challenge stems from the interrelated problems of attribution and deterrence in the cyber domain. Theoretically, anyone – state or non-state actor or even a lone hacker – can launch a cyberattack on any entity in any part of the world connected to cyberspace. Even air-gapped entities can be attacked, as happened in the case of Iranian nuclear program when it was attacked by highly sophisticated Stuxnet malware (Zetter, 2014). Attackers can mask or conceal their identities by routing the attack through multiple servers across the globe. Worse, they may also deliberately use particular systems or leave evidence to mislead the investigative agencies of the attacked countries (or entities) (Rid & Buchanan, 2015; Nye, 2017). Obtaining reliable attribution in such a situation remains very difficult. And even when reliable attribution is attainable, it may take considerable time to do the requisite technical analysis and corroboration with intelligence and other sources (Rid & Buchanan, 2015; Nye, 2017). A delayed attribution would, rather than helping the attacked country, bring its own set of problems: should it go public with the attribution? Should it retaliate, especially when significant time has elapsed and a retaliatory measure can be confused with an unprovoked attack, upping the escalatory potential?

The global security paradigm, since World War II and the testing and development of nuclear weapons by major powers, has been defined by deterrence (Nye, 2017; Morgan, 2010). Both conventional and nuclear deterrence emerge when a country threatens swift and damaging retribution for any attack, harming of interests or exceeding any threshold defined by it. But deterrence is not just about how many nuclear weapons, missiles, planes or tanks a country has or even the survivability of its arsenal in a first strike – even though all these factors are very important. Deterrence as a concept and practice is tied closely with reliable attribution (Nye, 2017). How does one deter an adversary that is either unknown or known but only with evidence of questionable reliability?

The questions of attribution and deterrence have plagued the cyber domain generally and they create additional complexities and challenges for the maritime sector. For cyberattacks on countries or their entities or infrastructure, the question of who will retaliate is clear even if the attacker is not known with surety; while for cyberattacks on maritime assets like large container ships, not just the attacker, but who holds the responsibility to respond is also unclear – would it be the company which is operating the ship? Or the one who built and owns the ship (if the damage is to the ship body)? Or the country where the ship is registered (such as Panama where ships are registered for tax benefits)? Or the countries from which the crew or affected passengers hail? Or the country where the operating company is registered?

The fourth challenge has to do with maritime cybersecurity incident reporting. As pointed out above, publicly available data on maritime cybersecurity incidents is very scant. Fear of ‘loss of customers’ as well ‘as many small-scale attacks’ going ‘unnoticed’ lead to underreporting of maritime cybersecurity incidents (Tam & Jones, 2019, p. 2). The scantness of data means that the exact enormity of the maritime cybersecurity problem is hard to know.